Data protection: your rights [1]

Individual rights

Novartis undertakes to respect your privacy and to adequately protect your personal information when collecting and sharing data with others as part of its legitimate commercial activities.

To supplement the Novartis Policy on the Protection of Personal Information, Novartis has adopted the Binding Corporate Rules (BCR), which set out a series of principles governing international transfers of personal information belonging to associates, customers and business partners of Novartis, as well as any other individuals whose data are collected and processed in the EU and Switzerland. Approval of the Novartis Binding Corporate Rules by the EU and the Swiss data protection authorities allows Novartis to comply with the data protection laws for the EU member states and Switzerland when it transfers your personal information from these countries to Novartis subsidiaries around the world.


What personal data protection principles apply?

Any Novartis company that transfers your personal information from the EU or Switzerland to another country must comply with the relevant laws, as well as with Novartis policies and the Binding Corporate Rules. More specifically, these companies will:

  • collect and process your personal information transparently and lawfully; 
  • process your personal information for specific, legitimate purposes only and not for any other purpose;
  • inform you when your personal information is to be transferred and request your consent when required under local laws;
  • retain your personal information only for as long as necessary, unless longer or shorter retention periods are required or permitted by law;
  • preserve the confidentiality of your personal information and implement appropriate and reasonable security measures to protect it from unauthorised access, damage or accidental loss, misuse, and unauthorised alteration or deletion.


Which are my rights?

If you are an associate, customer or business partner of Novartis or any other person whose

personal information has been collected and processed by Novartis in the EU or Switzerland, you have the following rights:

  • you may ask Novartis for information about its collection and use of your personal information in accordance with applicable local laws; 
  • you may ask Novartis to correct, erase or cease to use your personal information if such is incomplete or inaccurate;
  • you may oppose the processing of your personal information and request Novartis to stop processing your data, as long as you have legitimate grounds to do so; and
  • you may request the review of decisions taken on the basis of the automatic processing of your personal information in the event that these decisions have a significant impact on you.


How can I exercise my rights?

In the event that your personal information has been transferred to a Novartis company in a country other than a EU member state or Switzerland, which does not offer adequate protection, and if you believe that your personal information has been processed against the Binding Corporate Rules, you may:

  • file a complaint to the Novartis Business Practices Office (BPO) by emailing: [2]. Your complaint will be investigated in line with our internal procedures.
  • file a complaint to the relevant data protection authority or take legal action before the Swiss courts or the courts of the EU member state from which your personal information has been transferred.

© 2021 Novartis Farmacéutica, SA

This website is intended for users in Spain